FCA Non-Financial Misconduct Rules Live (PS25/23)

Final FCA/PRA rules incorporating non-financial misconduct — bullying, harassment, discrimination — into the SMCR Fit and Proper framework take effect. Firms must have a compliant NFM policy and updated F&P assessment process in place.

→ NFM Board Policy Pack

SMCR Reform — Final Rules Expected (CP25/21 / CP18/25)

FCA and PRA are consulting on the most significant SMCR reform since 2016 — changes to the Certification Regime, SoR simplification, and SMF consolidation. Final rules expected H1 2027. The duty of responsibility and personal liability are unchanged.

→ SMCR Reform Board Pack

ICO AI Code of Practice — Finalisation Expected

The ICO’s statutory AI Code of Practice is expected to be finalised in H2 2026, though legal commentary increasingly points to a 2027 finalisation given the required independent panel review and parliamentary process — timeline to be confirmed with the ICO directly. It sets out how data protection law applies to AI systems, including obligations on automated decision-making and explainability for firms using AI in customer-facing processes.

→ AI Risk Appetite Board Pack

UK Corporate Governance Code 2024 — Provision 29 (Internal Controls)

For financial years beginning on or after 1 January 2026, premium listed boards must make a declaration in the Annual Report on the effectiveness of their material controls framework. First Provision 29 declarations will appear in Annual Reports published in 2027.

→ UK Corporate Governance Code Board Pack

FCA Consumer Duty — Annual Board Report (2026 cycle)

PRIN 2A.10.11R required every FCA-regulated consumer-facing firm to produce and board-approve its annual Consumer Duty report by 31 July 2026. This year’s deadline has now passed; the next annual report is due by 31 July 2027.

→ Consumer Duty Board Report Pack

UK Sustainability Disclosure Standards (UK SDS / ISSB-aligned)

The UK government is developing UK SDS aligned to ISSB standards (IFRS S1 and S2). Mandatory reporting obligations for listed companies are expected to be phased in from 2027, starting with larger listed entities. Audit Committees and boards should begin gap assessments now.

Operational Resilience — Active Supervision Phase

The March 2025 deadline for firms to operate within Impact Tolerances has passed. FCA and PRA are now in active supervision mode. Firms that cannot demonstrate they operate within stated tolerances face regulatory challenge. Boards must evidence active oversight.

→ Operational Resilience Board Self-Assessment Pack

DORA (Digital Operational Resilience Act) — In Force

DORA applies to UK firms with EU operations or EU-regulated entities in group structures. ICT risk management, incident reporting, TLPT testing, and third-party oversight requirements are now fully operational. Boards of in-scope firms must have active oversight in place.

UK Corporate Governance Code 2024 — Provisions 25 & 40 (Audit & Rem)

Provision 25 (Audit Committee integrity obligations including sustainability) and Provision 40 (enhanced malus/clawback disclosure) apply for financial years beginning on or after 1 January 2025. Remuneration reports for 2025 financial years must comply with Provision 40.

→ Remuneration Committee Best Practice Pack